Phishing is the oldest trick in online crime, and it still works because it targets people, not computers. A message arrives that looks like it’s from your bank, a delivery company, or your boss. It asks you to click, log in, or pay. Learning to spot the warning signs is one of the best defenses you can have.
What phishing is
Phishing is an attempt to trick you into handing over sensitive information, such as passwords, card numbers, or verification codes, or into installing harmful software. It arrives by email, but also by text message, phone call, social media message, and even QR codes. Different names exist for different channels, but the idea is the same: pretend to be someone trustworthy to lower your guard.
Red flag 1: urgency and pressure
Scammers want you to act before you think. Typical lines include “Your account will be closed in 24 hours”, “Suspicious activity detected, verify now”, or “Your parcel can’t be delivered”. Real organizations do sometimes send time-sensitive notices, but they don’t expect you to panic. Pressure is a signal to slow down.
Red flag 2: the sender doesn’t quite match
Look at the sender’s address, not just the display name. A message from “Your Bank” might come from an address that has nothing to do with your bank, or a domain that’s nearly identical with a letter swapped or added. On a phone, tap the sender’s name to see the full address. Remember that addresses can be faked too, so use this as one clue among several.
Red flag 3: suspicious links
Before you click, hover over a link on a computer to see where it really goes, or press and hold on a phone to preview it. Be wary if the web address doesn’t match the company, contains strange extra words or characters, or comes from a shortened link that hides its destination. The safest habit is not to use the link at all: open the company’s official app or type the address yourself.
Red flag 4: unexpected attachments
Attachments can carry harmful software. Be especially careful with unexpected invoices, shipping documents, voicemail notifications, or files that ask you to enable macros or “enable editing”. If you weren’t expecting a file, check with the sender through another channel before opening it.
Red flag 5: requests for passwords, codes, or payment details
Legitimate companies don’t ask you to send your password by email or text, and they don’t ask you to read out a verification code. If a message asks for any of these, treat it as a scam. This is especially true for the six-digit codes sent to your phone when you log in. Anyone asking for one is almost certainly trying to access your account.
Red flag 6: generic greetings and odd wording
Messages that start “Dear customer” instead of your name, or that contain awkward phrasing, may be mass-produced. Be aware that modern scams can be polished and well written, so don’t rely on spelling mistakes alone. A clean message can still be a scam.
Red flag 7: too good to be true
Surprise prizes, unexpected refunds, easy job offers with high pay, and urgent requests for a favor from a “friend” all follow the same script. If something sounds unusually generous, or comes from nowhere, be suspicious. Be cautious with requests for gift cards, wire transfers, or payments in unusual ways.
Beware of text and voice scams
Text messages claiming to be from delivery companies, banks, or government offices are common. So are calls from people claiming to be tech support or bank security teams, who push you to move money or install software. A real bank won’t ask you to transfer money to a “safe account”. If a caller makes you uncomfortable, hang up and call the organization back on a number you find yourself, such as the one on your card or official website.
Your pause-and-check routine
- Stop. Don’t click or reply yet.
- Look. Check the sender, the link, and what’s being asked.
- Verify separately. Contact the organization through its official app, website, or phone number, not through the message.
- Decide. If you can’t verify it, delete it.
If you clicked or shared something
Don’t panic. Act quickly:
- If you entered a password, change it right away, along with any other account that uses the same password.
- Turn on two-factor authentication if you haven’t.
- If you shared card or bank details, contact your bank immediately so they can block or monitor the account.
- If you opened a suspicious attachment, disconnect the device from the internet and run a security scan.
- Keep a record of the message for reporting.
Report it
Most email services let you mark a message as phishing, which helps filter similar ones for everyone. You can also report to the organization that was impersonated and to your local cybercrime or consumer protection authority. Telling family and colleagues helps protect them.
Make yourself a harder target
- Use a password manager, which won’t autofill on fake sites.
- Enable two-factor authentication everywhere you can.
- Keep your phone, computer, and apps updated.
- Use your email provider’s spam and malware filters.
- Be careful about how much personal information you share publicly, since scammers use it to tailor messages.
FAQ
Can I get a virus just by opening an email?
It’s uncommon on modern systems, but the danger usually comes from clicking links or opening attachments. Avoid both with unexpected messages.
What should I do with a suspicious message?
Don’t reply or click. Report it using your email or messaging app, then delete it.
Are QR codes safe?
They can lead anywhere. Be careful with codes in unexpected places, such as stickers over real ones, and check the web address before entering any details.
How can I help older relatives?
Share the pause-and-check routine, agree that they’ll ask you before sending money or codes, and help them set up two-factor authentication.
The takeaway
Phishing works by rushing you. Slow down, check the sender and link, never share codes or passwords, and verify through official channels. If you ever fall for one, act quickly and report it. Anyone can be fooled, and a calm routine is your best protection.
